API overview

The four surfaces

Common response rules

• Every endpoint answers JSON with Content-Type: application/json; charset=utf-8.
• Success bodies carry a boolean ok where the handler bothers to set one; list endpoints return the collection under a named key such as items, games, reviews or sources.
• Errors are one shape: { "error": "a human sentence" }. There is no error code field, no error catalogue and no machine-readable reason, so branch on the status, not on the text.
• Workers add Cache-Control: no-store; the Studio API sends no cache headers of its own, so a CDN in front of it decides freshness.
• Preflight: both Workers answer OPTIONS with 204 and a 24-hour max age.

// every failure you will see
{
  "error": "Could not load listing analytics"
}

// and the status that actually identifies it
400  bad or missing input
401  no or invalid session token
403  authenticated but not permitted
404  row does not exist (or is not yours)
409  conflict with an existing record
500  handler threw
502  an upstream provider failed
504  a gateway timeout, see Rate limits

How the data is stored

The Studio API is a Node service over PostgreSQL, and listings are not rows with columns. Almost everything is a JSON document in one table.

GET /api/docs/:collection            -> that user's documents, newest first
GET /api/docs/:collection/:id        -> one document
PATCH /api/docs/:collection/:id      -> data = data || patch   (a merge, not a replace)
DELETE /api/docs/:collection/:id

// collections whose rows are only readable by their owner
webpages, notifications, payoutRequests, appeals, supportTickets

Public, optional and gated routes

Three tiers exist on the Studio API, and the tier is enforced per handler rather than by a global middleware.

What is not offered

• No API version in the path. Endpoints are whatever is deployed today.
• No sandbox environment and no test data mode; writes hit the same rows the store reads.
• No change log and no deprecation window. If an endpoint is documented here and behaves differently in production, production is right.
• No client libraries, no OpenAPI document, no SDK.
• No keys, no OAuth and no webhooks, see API keys, OAuth and Webhooks.